fix: wait for release builder platforms

docs/deployment-and-usage.md

@@ -287,10 +287,11 @@ The publisher deliberately uses `moby/buildkit:rootless` with
 `--oci-worker-no-process-sandbox`. On nested Docker hosts, the default OCI
 sandbox can fail while masking `/proc/acpi` for an emulated build; rootless
 BuildKit confines that compatibility setting to the disposable builder. It
-refuses to publish unless `docker buildx inspect` reports both `linux/amd64`
-and `linux/arm64`, and removes the builder and binfmt handler on success,
-failure, or interruption. Retain the displayed manifest digest in release
-notes and deploy the immutable tag or digest.
+waits briefly for the new worker to observe binfmt, then refuses to publish
+unless `docker buildx inspect` reports both `linux/amd64` and `linux/arm64`.
+On capability failure it prints that inspection output and removes the builder
+and binfmt handler on success, failure, or interruption. Retain the displayed
+manifest digest in release notes and deploy the immutable tag or digest.
 
 ## Operator usage
 

scripts/publish-image.sh

@@ -69,13 +69,32 @@ docker buildx create --name "${builder}" --driver docker-container \
   --buildkitd-flags "${buildkitd_flags}" --use >/dev/null
 builder_created=true
 
-platforms=$(docker buildx inspect "${builder}" --bootstrap 2>&1)
-for platform in linux/amd64 linux/arm64; do
-  if ! grep -Fq "${platform}" <<<"${platforms}"; then
-    echo "Builder ${builder} does not support ${platform}; refusing partial release." >&2
-    exit 1
+# A newly-created rootless worker can publish its native platform before it has
+# observed the just-registered binfmt handler. Do not mistake that brief
+# startup state for a partial-release-capable builder.
+platforms=''
+supports_all=false
+for attempt in {1..10}; do
+  platforms=$(docker buildx inspect "${builder}" --bootstrap 2>&1)
+  supports_all=true
+  for platform in linux/amd64 linux/arm64; do
+    if ! grep -Fq "${platform}" <<<"${platforms}"; then
+      supports_all=false
+      break
+    fi
+  done
+  if [[ ${supports_all} == true ]]; then
+    break
+  fi
+  if [[ ${attempt} -lt 10 ]]; then
+    sleep 1
   fi
 done
+if [[ ${supports_all} != true ]]; then
+  echo "Builder ${builder} does not support both required platforms; refusing partial release." >&2
+  printf '%s\n' "${platforms}" >&2
+  exit 1
+fi
 
 tags=(--tag "${repository}:${tag}")
 if [[ ${also_latest} == true ]]; then